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IN THE CLAIMS; 

1 . (original) A network data processing system for identifying, locating, and 
deleting viruses, comprising: 
a local server; 

a plurality of client data processing systems; and 
a bait server^ wherein 

the bait server monitors itself and, responsive to an attempt from an offending 
system within the network data processing system to access the bait server, the bait server 
broadcasts an indication that a virus attack is underway to all devices within the network 
data processing system, ignores all further access requests by the offending system until 
receiving an indication that tlie offending system has been disinfected, and directs the 
local server to disconnect the offending system from the network data processing system. 

2. (original) The network data processing system as recited in claim 1 , wherein the 
address of the bait server is not published to the plurality of client data processing 
systems. 

3. (original) The network data processing system as recited in claim 1, wherein the 
offending system includes more than one data pnjcessing system. 

4. (original) The network data processing system as recited in claim 1, wherein the 
offending system includes the local server. 

5. (original) The network data processing system as recited in claim 1, wherein the 
offending system includes a cheat data processing system. 

6. (original) Tlie network data processing system as recited in claim 1 , wherein the 
attempt fiom the offending system to access the bait server comprises an attempt to write 
to the bait server. 
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7. (original) Tbe network data processing system ^ recited in claim 1 , wherein the 
vims is a worm. 

8. (original) The network data processing system as recited in claim 1 , wherein the 
virus is a Trojan horse. 

9. (original) The network data processing system as recited in claim U wherein the 
network data processing system is configured to, once the offending system has been 
disinfected of the client, allow the offending system to reconnect to the network data 
processing system, 

1 0. (original) A meUiod for detecting the presence of a computer vims, the method 
comprising; 

receiving, at a bait server, a request to perform a ftmction on the bait server; 
identilying an offending system from which the request originated; 
alerting a local server that a vims attack is in progress and of the identity of the 
offending system; and 

directing the local server to disconnect the offending system from the network. 

1 U (original) The method as recited in claim 10, further comprising: 

prior to disconnecting the ofTendiiig system, notifying tlie offending system that it 
is infected with a virus. 

12. (original) The metliod as recited in claim 10, further comprising: 
rcceiving a reconnect request from the offending system; 

verifying that the offending system is disinfected and available to reconnect to tlie 
network; and 

reconnecting the offending system to the network. 

13. (cancelled) 
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14, (cancelled) 

15. (cancelled) 



1.6, (original) A raetliod iti a bait server for detecting the presence of a computer 
virus, the method comprising: 

monitoring a network for the presence of a computer virus; 

responsive to a determination that a virus is detected, determining the identity of 
an offending system within the network from which the virus entered the network; and 

directing the local server to disconnect the offending system firom tlie network. 

17, (original) The method as recited in claim 16, further comprising: 

instructing all devices within the network to ignore all requests from the offending 
system until the offending system has been disinfected and is available for network 
communication. 



18. (currently ajnendcd) The method as recited in claim 16, further comprising: 

notifying a local server of the presence of the virus and the identitY[[fy]] of the 
offendimg system. 



19. (original) The method as recited in claim 16, further comprising: 

responsive to an indication that tlie offending system has been disinfected and 
responsive to a recomiect request from the offending system, reconnecting the offending 
system to the network. 



use m a 



20. (original) A computer program product in a computer readable media for 
data processing system for detecting the presence of a computer virus, the computer 
program product comprising; 

first instructions for receiving, at a bait server, a request to perfoim a function on 
tile bait server; 

second instructions for identifying an offending system from which the request 
originated; 
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third instructions for alerting a local server that a vims attack is in progress and 
the identity of the offending system; and 

fourth instructions for disconnecting the offending system from a network. 

21 . (original) The computer program product as recited in claim 20, further 
comprising: 

fifth instructions for, prior to disconnecting the offending system, notifying the 
offending system that it is infected with a virus. 

22. (original) The computer program product as recited in claim 20, fiirther 
comprising: 

fifth instructions for receiving a reconnect request from the offending system; 
sixth instructions for verifying that the offending system is disinfected and 
available to reconnect to the network; and 

seventh instructions for reconnecting the offending system to the network. 



23. (cancelled) 



24. (cancelled) 

25. (cancelled) 

26. (original) A computer program product in a computer readable media for use in a 
data processing system in a bait server for detecting tlie presence of a computer virus, the 
computer program product comprising: 

fu-st instructions for monitoring a network for the presence of a computer virus; 

second instructions, responsive to a determination that a virus is detected, for 
determining the identity of an offending system within the network jfrom which tlie virus 
entered the network; and 

third instmctions for disconnecting the offeDding system from the network. 
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27. (original) The computer program product as recited in claim 26, further 
cornprising: 

fourth instructions for instructing all devices within the network to ignore all 
requests from the offending system until the offending system is reauthorized for network 
communication. 

28. (currently amended) The computer program product as recited in claim 26, 
ftirthcr comprising: 

fourth instructions for notifying a locaj server of the presence of the virus and the 
identitY[[fy]] of tlie offending system. 

29. (original) The computer program product as recited in claim 26, further 
comprising: 

fourth instructions, responsive to an indication that the offending system has been 
disinfected and responsive to a reconnect request from the offending system to the local 
server, for reconnecting the offending system to the network. 

30. (original) A system for detecting the presence of a computer virus, the system 
comprising; 

a receiver, at a bait server, which receives a request to perform a function on the 
bait server; 

an identifying unit which identifies an offending system from which the request 
originated; 

an virus alert unit which alerts a local server that a vims attack is in progress and 
the identity of tlie offending system; and 

disconnection unit which disconnects the offending system from a network. 

3 1 . (original) The system as recited in claim 30, further comprising: 

a notification unit which, prior to disconnecting the offending system, notifies the 
offending system that it is infected with a vmis. 
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32. (original) The system as recited in claim 30, further comprising: 

a reconnect request unit which receives a reconnect request from the offending 

system; 

a verification unit which verifies that the offending system is authorized to 
reconnect to the network; and 

a reconnecting unit which reconnects the offending system to the network. 

33. (cancelled) 



34. (cancelled) 

35. (cancelled) 



36. (originaj) A system in a bait server for detecting the presence of a computer 
virus, the system comprising: 

a monitoring unit which monitors a network for the presence of a computer virus; 

an identifier which, responsive to a determination that a virus is detected, 
determines the identity of an offending system within the network from which the virus 
entered the network; and 

a disconnection unit wliich disconnects the offending system from the network. 

37. (original) The system as recited in claim 36, further comprising: 

a network protection unit which instructs all devices within the network to ignore 
all requests from the offending system until the offending system is reauthorized for 
network communication. 

38. (currently amended) The system as recited in claim 36, fiirther comprising: 

a notification unit wliich notifies a loca] server of the presence of the virus and the 
identity[[fy]] of the offending system. 
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39. (original) The system as recited in claim 36, further comprising: 

a reconnection unit which, responsive to an indication that the offending system 
has been disinfected and responsive to a reconnect request fi-om the offending system, 
reconnects the offending system to the network. 
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